--- title: "Ransom at the Carnival: cyber security plan for ships" description: Recent cyber attack on Carnival Cruises and the importance of cyber security plan for ships image: https://channel16.dryadglobal.com/hubfs/Cruise%20Ship%20Twitter.png --- ###### 2 min read # Ransom at the Carnival: cyber security plan for ships By: [ Dryad Global ](https://channel16.dryadglobal.com/archive/author/dryad-global) on August 21, 2020 at 12:54 PM [Cyber Security](https://channel16.dryadglobal.com/archive/tag/cyber-security) - [**](https://twitter.com/GlobalDryad) - [**](https://www.linkedin.com/company/dryad-global/) - [**](https://www.youtube.com/channel/UCZSIjPkeq7iDcsj4r9TF9mg?sub_confirmation=1) ![Featured Image](https://channel16.dryadglobal.com/hubfs/Cruise%20Ship%20Twitter.png) Carnival Corporation & PLC is the largest cruise line operator in the world. In 2019, Carnival pulled in a record revenue of $20.8 billion. Even with the troubles of 2020, this makes them a significant target for attackers looking to earn a profit. On 15 August 2020, Carnival Corp & PLC detected a ransomware attack that encrypted a portion of one brand’s IT systems. Attackers not only encrypted the data, but also downloaded certain files indicating some data was stolen. In their SEC filings, the company states, “we expect that the security event included unauthorised access to personal data of guests and employees, which may result in potential claims from guests, employees, shareholders, or regulatory agencies. ” ![Cruise Ship Twitter](https://channel16.dryadglobal.com/hs-fs/hubfs/Cruise%20Ship%20Twitter.png?width=452&name=Cruise%20Ship%20Twitter.png)Some people may remember the breach Carnival experienced from April to July 2019 in which attackers stole data including, but not limited to names, addresses, social security numbers, credit card info, etc. Often cyber attackers will breach a network and linger there for future cyber-attacks. It is unclear if that is the case here. Carnival has yet to disclose the name of the ransomware which targeted the company. However - using Red Sky Alliance collections - analysts noticed a recent spike in external malicious activity related to the company. This was right before the current attack. Our collection showed a spike in indicators of compromise (IoCs) for the company around the 1st of August, specifically malicious email indicators. Some researchers speculate that attackers could have breached the company through the Citrix ADC (NetScaler) CVE-2019-19781 vulnerability. Others believe that CVE-2020-2021 could have been leveraged to gain unnoticed access to company’s networks. Carnival has neither confirmed nor denied this. Observed are externally collected IoCs which may identify some of the malicious activity that could have resulted in an activation of ransomware on the Carnival network. As an example, the most recent activity observed by Red Sky Alliance analysts shows a malicious email being sent from one employee to another.[![Sign up for Cyber Threat Notifications](https://no-cache.hubspot.com/cta/default/4795492/ff3a00ae-4c94-4a28-bbd6-554582c82747.png)](https://cta-redirect.hubspot.com/cta/redirect/4795492/ff3a00ae-4c94-4a28-bbd6-554582c82747) **How did this happen?** Initially an employee, who identifies himself as ‘general counsel,’ received an email and attachment claiming that the employee had a pending VM (voicemail) message on 3 August 2020. The Carnival employee then forwarded the malicious attachment to an employee identifying himself as a [Caribbean Country] Coordinator and asked if the voicemail was legitimate. It is likely that the general counsel employee inadvertently passed malware to the other employee. Because Red Sky Alliance does not have access to any internal data for the company, analysts are unable to determine if this attempted attack was successful. Notably the same general counsel employee has breach data as far back as May 2017. This may indicate that attackers were inside their network as far back as 2017. In the past 30 days, there are over a dozen breached accounts for Carnival published online. Also observed, are multiple historical indicators of compromise over the past few years. In some cases, attackers gain access to a network and remain there undetected for a while before executing their attack. Red Sky Alliance has observed more than breach data being exposed for the company. For example, at the end of 2019, a phishing link was observed containing a Human Resources (HR) email address for the company. Over the course of 2019, there were 8 other phishing links observed containing Carnival email addresses. This highlights the need for maritime cyber risk management. Red Sky Alliance strongly recommends ongoing monitoring from both internal and external perspectives. Internal monitoring is common practice. However, external threats are often overlooked and can represent an early warning of impending attacks. [![Book a no-obligation Cyber Consultation](https://no-cache.hubspot.com/cta/default/4795492/c8d188a0-13f5-40d7-9c47-71d41ef187fe.png)](https://cta-redirect.hubspot.com/cta/redirect/4795492/c8d188a0-13f5-40d7-9c47-71d41ef187fe) Dryad Global and partners Red Sky Alliance can provide both internal monitoring in tandem with RedXray notifications on external threats to include, botnet activity, public data breaches, phishing, fraud, and general targeting.  • Reporting: https://www.redskyalliance.org/ • Website: https://www.wapacklabs.com/ • LinkedIn: https://www.linkedin.com/company/64265941 ###### Share article [![Share on Facebook](https://channel16.dryadglobal.com/hs-fs/hubfs/Drayad_DMP21/Images/fb.png?width=24&name=fb.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fchannel16.dryadglobal.com%2Farchive%2Fransom-at-the-carnival%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on LinkedIn](https://channel16.dryadglobal.com/hs-fs/hubfs/Drayad_DMP21/Images/linkedin.png?width=24&name=linkedin.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fchannel16.dryadglobal.com%2Farchive%2Fransom-at-the-carnival%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on Twitter](https://channel16.dryadglobal.com/hs-fs/hubfs/Drayad_DMP21/Images/twitter.png?width=24&name=twitter.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fchannel16.dryadglobal.com%2Farchive%2Fransom-at-the-carnival%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fchannel16.dryadglobal.com%2Farchive%2Fransom-at-the-carnival%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Ransom%20at%20the%20Carnival%3A%20cyber%20security%20plan%20for%20ships) [![Share on Pinterest](https://channel16.dryadglobal.com/hs-fs/hubfs/Drayad_DMP21/Images/pinterest.png?width=24&name=pinterest.png)](http://pinterest.com/pin/create/button/?url=https%3A%2F%2Fchannel16.dryadglobal.com%2Farchive%2Fransom-at-the-carnival%3Futm_medium%3Dsocial%26utm_source%3Dpinterest&media=https%3A%2F%2Ff.hubspotusercontent40.net%2Fhubfs%2F4795492%2FDrayad_DMP21%2FImages%2Fpinterest.png) [![Share on Email](https://channel16.dryadglobal.com/hs-fs/hubfs/Drayad_DMP21/Images/mail.png?width=24&name=mail.png)](mailto:?subject=Check%20out%20https%3A%2F%2Fchannel16.dryadglobal.com%2Farchive%2Fransom-at-the-carnival%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fchannel16.dryadglobal.com%2Farchive%2Fransom-at-the-carnival%3Futm_medium%3Dsocial%26utm_source%3Demail) #### Related Posts ### [Cyber Security at Sea: Protecting Superyachts.. Luxury yachting demands seamless connectivity, operational efficiency, and an uncompromised onboard..](https://channel16.dryadglobal.com/archive/cyber-security-at-sea-protecting-superyachts-with-cyber-voyager) ### [Cyber-SHIP Lab/IMO Maritime Cyber Security &.. We're thrilled to share highlights from Day 1 of the Cyber-SHIP Lab/IMO Maritime Cyber Security &..](https://channel16.dryadglobal.com/archive/cyber-ship-lab/imo-maritime-cyber-security-resilience-symposium-2024) ### [Dryad Global Shortlisted for SAFETY4SEA Cyber.. We’re proud to share that Dryad Global has been officially shortlisted for the 2025 SAFETY4SEA..](https://channel16.dryadglobal.com/archive/dryad-global-shortlisted-for-safety4sea-cyber-security-award-2025) ##### Twitter Feeds Twitter Feeds [Follow @GlobalDryad](https://twitter.com/GlobalDryad?ref_src=twsrc%5Etfw)   ##### Channel 16 Channel 16 ###### [Cross-Strait relations in the Lai era](https://channel16.dryadglobal.com/archive/cross-strait-relations-in-the-lai-era) On May 20, Lai Ching-te was inaugurated as Taiwan's new president, prompting significant military... ##### Know More Know More ##### Reach Us Reach Us Press/media contact [Email Us](mailto:press@dryadglobal.com) General Enquiries [Contact Us Here](https://share.hsforms.com/1nNmumgLKRy6b7zdktrR3FQ2us84) [![DG Logo Horizontal NEW White](https://channel16.dryadglobal.com/hs-fs/hubfs/Branding/DG%20Logo%20Horizontal%20NEW%20White.png?width=280&height=100&name=DG%20Logo%20Horizontal%20NEW%20White.png "DG Logo Horizontal NEW White")](https://dryadglobal.com) © 2024 Dryad Global. All Rights Reserved [**](https://twitter.com/GlobalDryad)[**](https://www.linkedin.com/company/dryad-global/)[**](https://www.youtube.com/c/IMSAGlobalDryad) ** ![](https://px.ads.linkedin.com/collect/?pid=1152100&fmt=gif) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Dryad Global", "url" : "https://channel16.dryadglobal.com/archive/author/dryad-global" }, "dateModified" : "2020-08-22T20:53:35.202Z", "datePublished" : "2020-08-21T11:54:44.000Z", "headline" : "Ransom at the Carnival: cyber security plan for ships", "image" : [ "https://channel16.dryadglobal.com/hubfs/Cruise%20Ship%20Twitter.png" ], "mainEntityOfPage" : { "@id" : "https://channel16.dryadglobal.com/archive/ransom-at-the-carnival", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://channel16.dryadglobal.com/hubfs/DG%20Logo%20Featured%20Image%20Green.png" }, "name" : "Dryad Global Ltd" } } ```